2025年2月漏洞公告

2025年1月漏洞公告

2024年12月漏洞公告

2024年11月漏洞公告

2024年10月漏洞公告

2024年9月漏洞公告

漏洞1：<figure class="table" style="width:481.7000pt;"><table><tbody><tr><td style="border:1.0000pt solid windowtext;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">漏洞名称：南大通用GBase8a JDBC驱动反序列化漏洞</td></tr><tr><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:184.0500pt;">漏洞类别：反序列化漏洞</td><td style="border:1.0000pt solid windowtext;padding:0.0000pt;vertical-align:top;width:297.6500pt;">漏洞级别：低危</td></tr><tr><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:184.0500pt;">发布时间：2024-08</td><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt;vertical-align:top;width:297.6500pt;">&nbsp;</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">受影响的GBase相关产品或组件：GBase 8a JDBC驱动</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">漏洞简要描述：</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">反序列化漏洞。攻击者可能通过该缺陷通过jdbc建立到数据库服务的连接，进行反序列化操作，进行cc7攻击。</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">修复及缓解措施建议</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">修复措施：通过升级版本修复。请升级到gbase-connector-java-9.5.0.7以上版本。下载链接见https://www.gbase.cn/download/gbase-8a?category=DRIVER_PACKAGE</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">&nbsp;</td></tr></tbody></table></figure>漏洞2：<figure class="table" style="width:481.7000pt;"><table><tbody><tr><td style="border:1.0000pt solid windowtext;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">漏洞名称：南大通用GBase8a JDBC驱动&nbsp;XML外部实体注入漏洞</td></tr><tr><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:184.0500pt;">漏洞类别：XXE漏洞</td><td style="border:1.0000pt solid windowtext;padding:0.0000pt;vertical-align:top;width:297.6500pt;">漏洞级别：低危</td></tr><tr><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:184.0500pt;">发布时间：2024-08</td><td style="border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt;vertical-align:top;width:297.6500pt;">&nbsp;</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">受影响的GBase相关产品或组件：gbase-connector-java-9.5.0.1</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">漏洞简要描述：</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">XML外部实体注入漏洞。攻击者可构造恶意的XML数据引入外部实体，造成XXE攻击。</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">修复及缓解措施建议</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">修复措施：通过升级版本修复。请升级到gbase-connector-java-9.5.0.7以上版本。下载链接见https://www.gbase.cn/download/gbase-8a?category=DRIVER_PACKAGE</td></tr><tr><td style="background-color:rgb(255, 255, 255);border-bottom:1.0000pt solid windowtext;border-left:1.0000pt solid windowtext;border-right:1.0000pt solid windowtext;border-top-style:none;padding:0.0000pt 5.4000pt;vertical-align:top;width:481.7000pt;" colspan="2">&nbsp;</td></tr></tbody></table></figure>

名称	下载
GBase8a_MPP_Cluster-NoLicense-FREE-9.5.3.28.12-redhat8-aarch64.tar.bz2
GBase8a_MPP_Cluster-NoLicense-FREE-9.5.3.28.12-redhat8-x86_64.tar.bz2
GBase8a_MPP_Cluster-NoLicense-FREE-9.5.3.28.12-redhat7-x86_64.tar.bz2

GBase 8a MPP Cluster V9